@pikku/inspector 0.12.52 → 0.12.55

package/src/add/audit-meta.test.ts

@@ -0,0 +1,75 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { InspectorLogger } from '../types.js'
+
+const silentLogger = (): InspectorLogger =>
+  ({
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: () => {},
+    critical: () => {},
+    hasCriticalErrors: () => false,
+  }) as InspectorLogger
+
+async function metaFor(source: string) {
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-audit-'))
+  const file = join(rootDir, 'subject.ts')
+  await writeFile(file, source)
+  const state = await inspect(silentLogger(), [file], { rootDir })
+  await rm(rootDir, { recursive: true, force: true })
+  return Object.values(state.functions.meta) as any[]
+}
+
+const func = (name: string, auditLine: string | null) =>
+  [
+    "import { pikkuFunc } from '@pikku/core'",
+    `export const ${name} = pikkuFunc({`,
+    ...(auditLine ? [`  ${auditLine}`] : []),
+    '  func: async () => ({ ok: true }),',
+    '})',
+  ].join('\n')
+
+describe('the audit flag reaches the function meta', () => {
+  test('`audit: true` resolves to best-effort', async () => {
+    const meta = await metaFor(func('cancelInvoice', 'audit: true,'))
+    assert.deepEqual(meta.find((m) => m.name === 'cancelInvoice')?.audit, {
+      durability: 'best-effort',
+    })
+  })
+
+  test('an explicit durability is carried through', async () => {
+    const meta = await metaFor(
+      func('chargeCard', "audit: { durability: 'transactional' },")
+    )
+    assert.deepEqual(meta.find((m) => m.name === 'chargeCard')?.audit, {
+      durability: 'transactional',
+    })
+  })
+
+  test('an object without a durability defaults to best-effort', async () => {
+    const meta = await metaFor(func('refund', 'audit: {},'))
+    assert.deepEqual(meta.find((m) => m.name === 'refund')?.audit, {
+      durability: 'best-effort',
+    })
+  })
+
+  // Absent rather than `false`: an unmarked function drops `auditLog.write()`
+  // with a warning, so "no audit key" has to be the honest reading of it.
+  test('a function with no audit config carries no audit key', async () => {
+    const meta = await metaFor(func('listInvoices', null))
+    const found = meta.find((m) => m.name === 'listInvoices')
+    assert.ok(found, 'the function should still be registered')
+    assert.equal(found.audit, undefined)
+  })
+
+  test('`audit: false` is the same as not declaring it', async () => {
+    const meta = await metaFor(func('healthCheck', 'audit: false,'))
+    assert.equal(meta.find((m) => m.name === 'healthCheck')?.audit, undefined)
+  })
+})

package/src/add/secret-sink-check.test.ts

@@ -0,0 +1,211 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger } from '../types.js'
+
+function makeLogger() {
+  const diagnostics: Array<{ code: ErrorCode; message: string }> = []
+  const logger: InspectorLogger = {
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }) => diagnostics.push({ code, message }),
+    critical: (code, message) => diagnostics.push({ code, message }),
+    hasCriticalErrors: () => diagnostics.length > 0,
+  }
+  return { logger, diagnostics }
+}
+
+/**
+ * Stands in for @pikku/core, which is not importable from a tmp dir. The shapes
+ * are what matters: `Secret<T>` is the optional brand `.reveal()` returns, and
+ * the service interfaces are matched by name, so these must keep the real names.
+ */
+const PRELUDE = `
+type Secret<T> = T & { readonly __classification__?: 'secret' }
+
+declare class SecretValue<T = string> {
+  private brand: T
+  reveal(): Secret<T>
+}
+
+interface Logger {
+  info(messageOrObj: any, ...meta: any[]): void
+  error(messageOrObj: any, ...meta: any[]): void
+}
+interface QueueService {
+  add<T>(queueName: string, data: T): Promise<string>
+}
+interface EmailService {
+  send(input: any): Promise<void>
+}
+interface WebhookService {
+  send(input: any): Promise<void>
+}
+interface AuditService {
+  audit(event: { type: string; input?: unknown }): Promise<void>
+}
+interface AuditLog {
+  write(event: { type: string; input?: unknown }): Promise<void>
+}
+
+type Services = {
+  logger: Logger
+  queueService: QueueService
+  email: EmailService
+  webhooks: WebhookService
+  audit?: AuditService
+  auditLog?: AuditLog
+  secrets: { getSecret(key: string): Promise<SecretValue<string>> }
+}
+
+declare const pikkuFunc: <In, Out>(cfg: {
+  func: (services: Services, data: In) => Promise<Out>
+}) => unknown
+`
+
+async function runInspect(source: string) {
+  const tmpDir = await mkdtemp(join(tmpdir(), 'pikku-secret-sink-test-'))
+  const file = join(tmpDir, 'funcs.ts')
+  await writeFile(file, PRELUDE + source)
+  const { logger, diagnostics } = makeLogger()
+  try {
+    await inspect(logger, [file], { rootDir: tmpDir, classificationCheck: true })
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true })
+  }
+  return diagnostics
+}
+
+const sinkErrors = (diagnostics: Array<{ code: ErrorCode; message: string }>) =>
+  diagnostics.filter((d) => d.code === ErrorCode.SECRET_REVEALED_INTO_SINK)
+
+describe('PKU953 — a revealed secret reaching a sink', () => {
+  test('flags a secret logged inline', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = await secrets.getSecret('API_KEY')
+          logger.info(token.reveal())
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 1)
+    assert.match(errors[0]!.message, /logger\.info/)
+  })
+
+  test('flags a secret that reaches the sink through a local binding', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          logger.error('auth failed', { token })
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 1)
+    assert.match(errors[0]!.message, /logger\.error/)
+    assert.match(errors[0]!.message, /token/)
+  })
+
+  test('flags a secret enqueued, emailed or sent to a webhook', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ queueService, email, webhooks, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          await queueService.add('jobs', { token })
+          await email.send({ to: 'a@b.c', text: token })
+          await webhooks.send({ url: 'https://x', data: { token } })
+        },
+      })
+    `)
+    assert.equal(sinkErrors(diagnostics).length, 3)
+  })
+
+  test('flags a secret written to an audit, through the optional chain it is reached by', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ audit, auditLog, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          await audit?.audit({ type: 'used', input: { token } })
+          await auditLog?.write({ type: 'used', input: token })
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 2)
+    assert.match(errors[0]!.message, /audit\.audit/)
+    assert.match(errors[1]!.message, /auditLog\.write/)
+  })
+
+  test('flags console, which no type guard covers', async () => {
+    const diagnostics = await runInspect(`
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ secrets }) => {
+          const token = await secrets.getSecret('API_KEY')
+          console.log(token.reveal())
+        },
+      })
+    `)
+    const errors = sinkErrors(diagnostics)
+    assert.equal(errors.length, 1)
+    assert.match(errors[0]!.message, /console\.log/)
+  })
+
+  test('stays quiet when the secret never reaches a sink', async () => {
+    const diagnostics = await runInspect(`
+      declare function authenticate(token: string): Promise<void>
+
+      export const fine = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = (await secrets.getSecret('API_KEY')).reveal()
+          await authenticate(token)
+          logger.info('authenticated')
+        },
+      })
+    `)
+    assert.equal(sinkErrors(diagnostics).length, 0)
+  })
+
+  test('stays quiet for ordinary logging', async () => {
+    const diagnostics = await runInspect(`
+      export const fine = pikkuFunc<{ id: string }, void>({
+        func: async ({ logger }, data) => {
+          logger.info('processing', { id: data.id, at: new Date() })
+        },
+      })
+    `)
+    assert.equal(sinkErrors(diagnostics).length, 0)
+  })
+
+  test('does not run without the classification flag', async () => {
+    const tmpDir = await mkdtemp(join(tmpdir(), 'pikku-secret-sink-off-'))
+    const file = join(tmpDir, 'funcs.ts')
+    await writeFile(
+      file,
+      PRELUDE +
+        `
+      export const leak = pikkuFunc<void, void>({
+        func: async ({ logger, secrets }) => {
+          const token = await secrets.getSecret('API_KEY')
+          logger.info(token.reveal())
+        },
+      })
+    `
+    )
+    const { logger, diagnostics } = makeLogger()
+    try {
+      await inspect(logger, [file], { rootDir: tmpDir })
+    } finally {
+      await rm(tmpDir, { recursive: true, force: true })
+    }
+    assert.equal(sinkErrors(diagnostics).length, 0)
+  })
+})

package/src/error-codes.ts

@@ -29,6 +29,7 @@ export enum ErrorCode {
   WORKFLOW_ORCHESTRATOR_NOT_CONFIGURED = 'PKU600',
   INVALID_DSL_WORKFLOW = 'PKU641',
   WORKFLOW_GRAPH_ADDON_NOT_WIRED = 'PKU642',
+  COMPLEX_WORKFLOW_NOT_ALLOWED = 'PKU643',
 
   // Remote addon (wireRemoteAddon) validation
   REMOTE_ADDON_NOT_DEV_DEPENDENCY = 'PKU338',
@@ -38,6 +39,9 @@ export enum ErrorCode {
   DB_COLUMN_NAME_TYPE_CONTRADICTION = 'PKU480',
   DB_JSON_COLUMN_UNTYPED = 'PKU481',
   DB_FORMAT_ON_NON_STRING = 'PKU482',
+  DB_SECRET_COLUMN_STORED_PLAIN = 'PKU483',
+  DB_FORM_ON_NON_STRING = 'PKU484',
+  DB_DEFAULT_SCHEMA_NAME_COLLISION = 'PKU485',
 
   // Configuration errors
   SCHEMA_GENERATION_ERROR = 'PKU456',
@@ -50,12 +54,20 @@ export enum ErrorCode {
   DUPLICATE_AUTH_DEFINITION = 'PKU581',
   AUTH_NOT_EXPORTED = 'PKU582',
 
+  // Single-declaration constructs — one call site per codebase.
+  // PKU583 (defineScope) and PKU584 (defineSystemRole) are retired, not free:
+  // scopes and roles held this rule until the generated `admin` tree made it
+  // unsatisfiable, and get it back once `admin` is a default scope nobody
+  // declares. Do not reuse those two numbers for anything else.
+  DUPLICATE_PERSONAS_DEFINITION = 'PKU585',
+
   // HTTP Route errors
   ROUTE_PARAM_MISMATCH = 'PKU571',
   ROUTE_QUERY_MISMATCH = 'PKU572',
   AUTH_DISABLED_REQUIRES_SESSIONLESS = 'PKU573',
   EXPOSED_FUNCTION_HAS_NO_GATE = 'PKU574',
   TAG_RESOLVES_TO_NO_MIDDLEWARE = 'PKU575',
+  PERMISSIONS_IN_BODY_NOT_ALLOWED = 'PKU576',
 
   // Versioning errors
   DUPLICATE_FUNCTION_VERSION = 'PKU850',
@@ -103,6 +115,7 @@ export enum ErrorCode {
   SECRET_SERVICE_ALIASED = 'PKU950',
   SECRET_NOT_DECLARED = 'PKU951',
   SECRET_KEY_NOT_STATIC = 'PKU952',
+  SECRET_REVEALED_INTO_SINK = 'PKU953',
 }
 
 /**

package/src/types.ts

@@ -335,6 +335,15 @@ export type InspectorOptions = Partial<{
    * function, which is expensive. Enabled via `pikku all --security`.
    */
   classificationCheck: boolean
+  /**
+   * Escape hatches the project has opted into, from `allow` in
+   * `pikku.config.json`. Absent or false means the feature is refused with a
+   * critical naming the flag that would permit it.
+   */
+  allow: Partial<{
+    permissionsInBody: boolean
+    complexWorkflows: boolean
+  }>
 }>
 
 export interface InspectorLogger {

package/src/utils/check-secret-sinks.ts

@@ -0,0 +1,145 @@
+import * as ts from 'typescript'
+import { findPiiPaths } from './check-pii-output.js'
+import { doesTypeExtendsCore } from './does-type-extend-core-type.js'
+
+export type SecretSinkViolation = {
+  /** How the value reaches the outside world, e.g. `logger.info`. */
+  sink: string
+  /** Dotted path to the secret inside the argument, or `<argument>` when bare. */
+  path: string
+  /** Position of the offending argument, for the diagnostic message. */
+  line: number
+}
+
+/**
+ * A method that writes its arguments somewhere a secret must never land, keyed
+ * by the core interface that owns it. `'*'` means every method on the type is a
+ * sink, which is true of a logger.
+ */
+const SINKS: Array<{ coreType: string; methods: '*' | string[] }> = [
+  { coreType: 'Logger', methods: '*' },
+  { coreType: 'QueueService', methods: ['add'] },
+  { coreType: 'EmailService', methods: ['send'] },
+  { coreType: 'WebhookService', methods: ['send'] },
+  { coreType: 'AuditService', methods: ['audit', 'write'] },
+  { coreType: 'AuditLog', methods: ['write'] },
+]
+
+/**
+ * Finds revealed vault secrets that flow into a sink.
+ *
+ * `SecretValue` is nominally typed, so the type system alone stops it reaching
+ * any of these. `.reveal()` is the deliberate escape hatch, and it hands back
+ * `Secret<T>` — the erasable classification brand. That brand is what this scan
+ * follows, which means it catches the revealed value both inline
+ * (`logger.info(s.reveal())`) and through a local binding, because the local's
+ * inferred type carries the brand too.
+ *
+ * The brand is optional by design, so an explicit annotation (`const t: string =
+ * s.reveal()`) erases it and this scan goes quiet. That is the documented limit
+ * of a structural marker: it catches the mistake, not someone determined to
+ * silence it.
+ *
+ * Sinks are matched on the receiver's resolved core interface, which means the
+ * scan needs the services parameter to be typed. Real projects get that from
+ * the generated `#pikku` factory; a hand-rolled file that calls the raw core
+ * factory without annotating its services leaves the parameter `any`, and an
+ * `any` receiver matches nothing.
+ */
+export function findRevealedSecretSinks(
+  checker: ts.TypeChecker,
+  handler: ts.Node
+): SecretSinkViolation[] {
+  const violations: SecretSinkViolation[] = []
+
+  const visit = (node: ts.Node): void => {
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+      const sink = describeSink(checker, node.expression)
+      if (sink) {
+        for (const arg of node.arguments) {
+          const found = findSecretExpression(checker, arg)
+          if (found) {
+            violations.push({
+              sink,
+              path: found.getText(),
+              line:
+                found
+                  .getSourceFile()
+                  .getLineAndCharacterOfPosition(found.getStart()).line + 1,
+            })
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(handler)
+
+  return violations
+}
+
+/**
+ * Finds the first expression inside a sink argument whose own type carries the
+ * secret brand, and returns it so the diagnostic can quote it.
+ *
+ * This walks the argument rather than typing it whole, because an object
+ * literal in an argument position is contextually typed by the parameter — for
+ * a guarded sink that parameter is `Safe<M>`, and resolving the literal against
+ * it drops the optional brand before it can be read. Each inner expression
+ * (`token.reveal()`, or a reference to a local holding it) carries its own type
+ * regardless of the surrounding context, so reading those is what actually
+ * sees the secret.
+ */
+function findSecretExpression(
+  checker: ts.TypeChecker,
+  node: ts.Node
+): ts.Expression | undefined {
+  // Descend first, so an object literal wrapping the secret reports the
+  // expression that actually holds it (`token.reveal()`) rather than the whole
+  // literal. Nothing inside a `SecretValue` receiver is itself branded, so a
+  // bare `token.reveal()` still falls through to the self-check below.
+  for (const child of node.getChildren()) {
+    // A property name is not a value, and typing it re-resolves the property.
+    if (ts.isPropertyAssignment(node) && child === node.name) continue
+    const found = findSecretExpression(checker, child)
+    if (found) return found
+  }
+
+  if (ts.isExpression(node) && !ts.isStringLiteralLike(node)) {
+    const type = checker.getTypeAtLocation(node)
+    const isSecret = findPiiPaths(checker, type).some(
+      (f) => f.classification === 'secret'
+    )
+    if (isSecret) return node
+  }
+
+  return undefined
+}
+
+/**
+ * Names the sink a call writes to, or undefined when the call is not one.
+ * `console` is matched by identifier because it is a global with no Pikku type;
+ * everything else is matched on its resolved core interface so a renamed
+ * service or a decorator still counts.
+ */
+function describeSink(
+  checker: ts.TypeChecker,
+  callee: ts.PropertyAccessExpression
+): string | undefined {
+  const method = callee.name.text
+  const receiver = callee.expression
+
+  if (ts.isIdentifier(receiver) && receiver.text === 'console') {
+    return `console.${method}`
+  }
+
+  const receiverType = checker.getTypeAtLocation(receiver)
+  for (const { coreType, methods } of SINKS) {
+    if (methods !== '*' && !methods.includes(method)) continue
+    if (doesTypeExtendsCore(receiverType, checker, new Set(), coreType)) {
+      return `${receiver.getText()}.${method}`
+    }
+  }
+
+  return undefined
+}

package/src/utils/post-process.ts

@@ -817,7 +817,10 @@ export function validateScenarioSteps(
     // nothing threw. It is also invisible to witness coverage — it contributes
     // 0/0, so it can never lower the number — which makes an assertion-free
     // flow the cheapest way to make a suite look better covered than it is.
-    if (phasesSeen.size > 0 && !phasesSeen.has('then')) {
+    // `asserts` is the escape for a flow whose witness is an expectation helper
+    // instead: those are inline steps and leave no phase behind, but a recorded
+    // service call or a refusal is an assertion all the same.
+    if (phasesSeen.size > 0 && !phasesSeen.has('then') && !meta.asserts) {
       logger.critical(
         ErrorCode.SCENARIO_HAS_NO_ASSERTION,
         `Scenario '${workflowName}' has ${[...phasesSeen].join('/')} steps but never asserts. ` +

package/src/utils/single-declaration.ts

@@ -0,0 +1,57 @@
+import type { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger } from '../types.js'
+
+/**
+ * Claims the one call site a single-declaration construct is allowed.
+ *
+ * `definePersonas` takes a keyed object, so one call already declares as many
+ * entries as you like. Letting the call itself repeat buys nothing and costs
+ * the thing that matters: a single place to read the declared set from, and a
+ * single place to add to it. The same rule `pikkuBetterAuth` has had all along.
+ *
+ * A second call in the SAME file is refused too — "the file" is not an answer
+ * to "where do I add a persona?" when the file holds two calls, so allowing it
+ * would keep the ambiguity the rule exists to remove.
+ *
+ * A generated file is exempt, and never claims the slot either. The rule exists
+ * to name the one place a person adds to, and nobody adds to a file the CLI
+ * rewrites on the next run — `pikku-personas.gen.ts` would otherwise make every
+ * project that scaffolds one unbuildable, and take the app's own declaration
+ * down with it.
+ *
+ * `defineScope` and `defineSystemRole` held this rule too, briefly, and do not
+ * until the `admin` tree stops being app-declared. The exemption above is not
+ * enough for them: the CLI generates a `defineScope` in `user-admin.gen.ts` and
+ * `@pikku/addon-console` spells the same tree out again in a hand-written file,
+ * so two non-generated declarations remain and the build still fails. The fix
+ * is for `admin` to be a default scope nobody declares, and the rule comes back
+ * for scopes and roles once that lands.
+ *
+ * @param files - The construct's `files` set, which doubles as the claim.
+ * @returns true when the caller holds the claim and should carry on.
+ */
+export const claimSingleDeclaration = (
+  logger: InspectorLogger,
+  files: Set<string>,
+  code: ErrorCode,
+  helper: string,
+  sourceFile: string
+): boolean => {
+  if (sourceFile.endsWith('.gen.ts')) {
+    return true
+  }
+
+  const [first] = files
+  if (first === undefined) {
+    files.add(sourceFile)
+    return true
+  }
+
+  logger.critical(
+    code,
+    first === sourceFile
+      ? `Only one ${helper}(...) is allowed per codebase, so there is one place to read the declarations from and one place to add to. Found a second call in ${sourceFile}. Declare them all in one call.`
+      : `Only one ${helper}(...) is allowed per codebase, so there is one place to read the declarations from and one place to add to. Found a second in ${sourceFile} (first: ${first}). Declare them all in one call.`
+  )
+  return false
+}

package/src/utils/validate-exposed-functions-gated.test.ts

@@ -108,7 +108,7 @@ describe('validateExposedFunctionsGated', () => {
       // nobody reads.
       run(
         stateWith({
-          stripeWebhook: ungatedFunction({ selfAuthenticated: true }),
+          stripeWebhook: ungatedFunction({ permissionsInBody: true }),
         })
       )
 
@@ -118,7 +118,7 @@ describe('validateExposedFunctionsGated', () => {
     test('still warns when the declaration is explicitly false', () => {
       run(
         stateWith({
-          credentialGet: ungatedFunction({ selfAuthenticated: false }),
+          credentialGet: ungatedFunction({ permissionsInBody: false }),
         })
       )
 

package/src/utils/validate-exposed-functions-gated.ts

@@ -32,7 +32,7 @@ export function validateExposedFunctionsGated(
     // this check has no way to see. Taking the claim at face value is the
     // point: without it the warning fires forever on functions that are fine,
     // and a warning that is usually wrong stops being read.
-    if (meta.selfAuthenticated === true) continue
+    if (meta.permissionsInBody === true) continue
 
     // The function gates itself.
     if (meta.auth === true) continue
@@ -49,18 +49,27 @@ export function validateExposedFunctionsGated(
   const shown = ungated.slice(0, 10)
   const rest = ungated.length - shown.length
 
+  const one = ungated.length === 1
+
+  // Every function here is sessionless — that is the population, not the
+  // finding, so the message names it as given rather than reporting it as a
+  // defect. The remedies are the ones that can actually apply to an anonymous
+  // caller: `scopes` cannot, because `verifyScopes` fails closed on a session
+  // that does not exist, and telling someone to add them sends them to a
+  // MissingScopeError on every public request.
   logger.diagnostic({
     severity: 'warn',
     code: ErrorCode.EXPOSED_FUNCTION_HAS_NO_GATE,
     message:
-      `${ungated.length} exposed function${ungated.length === 1 ? '' : 's'} ` +
-      `require neither a session nor any permission or scope, and ` +
-      `${ungated.length === 1 ? 'is' : 'are'} reachable by anyone through ` +
+      `${ungated.length} exposed sessionless function${one ? '' : 's'} ` +
+      `carr${one ? 'ies' : 'y'} no permission and no addon gate, so ` +
+      `${one ? 'it is' : 'they are'} reachable by anyone through ` +
       `POST /rpc/:rpcName: ${shown.join(', ')}` +
       (rest > 0 ? `, and ${rest} more` : '') +
-      `. Add scopes or permissions to the function, gate the whole addon with ` +
-      `wireAddon({ scopes: [...] }), or drop \`expose: true\` if it was not ` +
-      `meant to be callable from outside.`,
+      `. Add permissions to the function, set \`auth: true\` if a session is ` +
+      `required after all, gate the whole addon with ` +
+      `wireAddon({ auth: true }), or drop \`expose: true\` if ` +
+      `${one ? 'it was' : 'they were'} not meant to be callable from outside.`,
   })
 }